The present invention relates to systems including programmable logic chips, and particularly to systems which include microprocessors or microcontrollers..sup.1 FNT .sup.1 In the following text (including the claims), the term "microprocessors" will normally be used as a generic term, including microcontrollers.
Some Technological Context
The following text will first summarize some background art of broad interest, preparatory to an extremely brief (and non-definitive) description of the claimed invention. To further explain the significance and advantages of the claimed invention, the general features of the preferred system context, including the claimed innovation and other innovations, will then be described.
Nonvolatility in Programmable Logic
There has been a great deal of work over the last five years in adding nonvolatile features into semiconductor memories and memory modules.
However, there are also great potential advantages to providing nonvolatility in microcontrollers and microprocessors:
For example, such a microprocessor could be made immune to power outages.
Similarly, a system built around a microprocessor of this type could be given the ability to power down during periods of no input and power up when input resumed without the user becoming aware of these functions.
In many control applications, processor nonvolatility can provide a convenient basis for adaptive software: by updating algorithm parameters over the history of the system, the fit to the real-world problem can be progressively improved.
Microprocessors with On-Chip Device-Level Nonvolatility
Numerous attempts have been made to provide on-chip nonvolatile memory. This has often been attempted using device technologies which provide nonvolatility, such as FAMOS devices (EEPROM or EPROM cells). However, this adds considerable processing complexity.
Examples of such attempts includeL Goss et al., ".mu.Cs with on-chip EEPROM provide system adaptability," EDN, Feb. 28,1986, pp. 189 ff, which is hereby incorporated by reference; Goss et al., "Single Chip Microcomputer with EEROM [sic] Creates Unique Product Opportunity," Midcon/85 Conference Record, paper 18/2, which is hereby incorporated by reference; Bursky, "On-chip EEPROM gives CMOS DSP IC flexibility," Electronic Design, May 14, 1987, pp. 55ff, which is hereby incorporated by reference.
Microprocessors with Battery-backed Nonvolatility
A pioneering nonvolatile microprocessor was the DS5000. (This integrated circuit, and its data sheet and User Handbook, are available from Dallas Semiconductor Corporation, 4401 South Beltwood Parkway, Dallas Tex. 75244, and are all hereby incorporated by reference.)
This chip has an architecture compatible with the Intel 8051, with various features added for nonvolatility. Thus, the DS5000 instruction set is a superset of the 8051 instruction set. The DS5000 can be directly inserted into any application which already uses the Intel 8051, and the additional features of the DS5000 can be exploited by the system designer and/or made use of by the application software.
However, many existing applications are designed around processors which do not use the 8051 architecture. It would, in principle, be possible to nonvolatize other microcontrollers and microprocessors using the principles incorporated in the DS5000; but that would be very expensive (due to the need for redesign of existing IC circuits and layouts).
Microcontroller System Architectures Generally
The market for 8-bit machines continues to grow, and may continue to remain significant at the low end of the market. However, an inconvenience, from the designer's point of view, is that 8-bit machines often have limited address space. For example, the use of 16-bit addresses means that only 64K words can be addressed, and many 8-bit machines are limited to an address space of 64K.
Some Complex Peripheral Chips Used in Microprocessor Systems
A variety of complex chips have been proposed for use as microprocessor peripherals. Such chips are used when a microprocessor system has to perform tasks 1) which can be accelerated by custom hardware, and/or 2) which can be separated out for processing in parallel. In either case, the interface with the microprocessor is typically designed very carefully, to provide the close data interface often required, while minimizing delays and minimizing burden on the microprocessor.
Various applications of this kind, with various interface requirements and solutions, have been considered. Two examples of interest are port expansion chips and memory management units (MMUs). Other examples, which are of less relevance but present some analogies, include Graphics chips and floating-point-accelerator units.
Nonvolatile Memory for Logic Initialization
See Danielson, "Initialize PIAs from NOVRAMs," EDN, Oct. 31, 1984, page 206; Rosini et al., "A 5V-only Single Chip Microcomputer with Nonvolatile SRAM," 1984 ISSCC Conference Record at 170ff; Millar et al., "Microcomputer Cuts Printer Controller Pin Count," Computer Design, March 1984, pp. 139ff; Berney, "Nonvolatile RAM provides on-board storage for computer," Electronics, Sep. 22, 1982, pp. 168ff; all of which are hereby incorporated by reference.
Peripheral Chips Which Control Power Supply to a CPU
A commonly owned U.S. Patent application.sup.2 shows a peripheral which can wake a microprocessor or (under the microprocessor's command) put the microprocessor to sleep. FNT .sup.2 Serial No. 282,793, Filed Dec. 9, 1988, entitled "Sleep Command Conditioned By Timing Window Derived From Strobe Pin", which is hereby incorporated by reference.
Another commonly owned U.S. Patent application.sup.3 shows a peripheral with even more power-management functions for low-power systems. FNT .sup.3 Ser. No. 282,198, Filed Dec. 9, 1988, entitled "Microprocessor System with Zero-power Standby", which is hereby incorporated by reference.
Peripheral Chips Which Provide "Port Expansion"
Peripherals have been provided for port expansion. For example, the Motorola MC6821,.sup.4 an 8-bit "PIA" (Peripheral Interface Adaptor), is one such. Another example is the Zilog "UPC" (Universal Peripheral Controller)..sup.5 FNT .sup.4 As stated in Motorola's data sheet for this part: "The MC6821 Peripheral Interface Adapter provides the universal means of interfacing peripheral equipment to the MC6800 family of microprocessors. This device is capable of interfacing the MPU to peripherals through two 8-bit unidirectional peripheral data buses and four control lines. No external logic is required for interfacing to most peripheral devices. FNT "The functional configuration of the PIA is programmed by the MPU during system initialization. Each of the peripheral data lines can be programmed to act as an input or output, and each of the four control/interrupt lines may be programmed for one of several control modes. This allows a high degree of flexibility in the overall operation of the interface." FNT This chip, and its data sheet, are both hereby incorporated by reference. FNT .sup.5 See Walters, "The Zilog UPC, a high performance slave peripheral controller," Electro/82 Conference Record paper 14/2, which is hereby incorporated by reference.
Peripheral Chips Which Provide Memory Management
Some peripheral chips, such as MMUs (Memory Management Units), do perform address remapping, in connection with bank swapping. See generally Furht and Milutinovic, "A Survey of Microprocessor Architectures for Memory Management," Computer magazine, March 1987, pp. 48ff., which is hereby incorporated by reference. Similarly, address translation is a basic part of any virtual memory system. However, the present inventors know of no prior peripheral which revectors a microprocessor's instruction fetches into the peripheral's on-chip ROM.
Fault-Tolerance in Computer Architectures
Much effort has been devoted to the problems of providing fault-tolerance in computer architectures. See generally Siewiorek, "Architecture of Fault-Tolerant Computers," Computer magazine, August 1984, pp. 9ff., which is hereby incorporated by reference.
Interrupts in Inter-Processor Interfaces
A great deal of work has been published regarding interrupt masking in inter-processor interfaces. One example (among many) is Abraham et al., "Use of processor masking as a locking technique for multilevel multiprocessor," 26 IBM Technical Disclosure Bulletin 2822 (November 1983), which is hereby incorporated by reference.
Ser. No. 567,436: Circuitry and Peripheral Chip for Flexible Electrical Interface
Among the innovations disclosed herein is an adjunct chip, usable as a peripheral to a microprocessor, which provides additional ports for the microprocessor's use, including at least one port which has tremendous flexibility of electrical configuration. The circuitry of this port is itself believed to be novel.
Ser. No. 567,418: Peripheral with Instruction Address Remapping and Shifting Overlay
Among the innovations disclosed herein is an adjunct chip, usable as a peripheral to a microprocessor, which transparently overlays control software address space onto the microprocessor's limited address space, while providing full access to the control software and to the instructions (or data) which may already be stored at any address within the address space. This is accomplished by using a shifting overlay map, and substituting addresses transparently to the microprocessor.
This is particularly advantageous with machines, such as 8-bit microprocessors and microcontrollers, which have limited address space (often only 64K).
Ser. No. 567,395: Peripheral with Instruction Address Remapping and Rigorously Separated Control Software Mode and User Software Mode
Among the innovations disclosed herein is an adjunct chip, usable as a peripheral to a microprocessor, which provides control software in secure memory, at an address range which is overlaid onto the addresses which otherwise would be accessed by the microprocessor to run programs from external memory. Execution of the control software is rigorously separated from execution of user (application) software: once the microprocessor is executing control software, the adjunct chip will issue a reset before allowing the microprocessor to return to execution of application software.
The control software is allowed to access several system configuration options which the user software is not allowed to access. For example, the memory space is preferably configurable in several different ways, but memory reconfiguration is not permitted from user software.
In alternative embodiments (but not in the presently preferred embodiment) the watchdog can be allowed to be reprogrammed (or turned off or turned on) only from control software, not from application software.
Ser. No. 567,396: Integrated Circuit with Parameter RAM accessible only during execution of Safeguarded Control Software
Among the innovations disclosed herein is an adjunct chip, usable as a peripheral to a microprocessor, which can issue resets and/or interrupts to the microprocessor, and which can force the microprocessor to execute control software programs which are stored in secure memory. (The control software is preferably, but necessarily, addressed at an address range which is overlaid onto the addresses which otherwise would be accessed by the microprocessor to run programs from external memory.) Execution of the control software is rigorously separated from execution of user (application) software: once the microprocessor is executing control software, the adjunct chip will issue a reset before allowing the microprocessor to return to execution of application software.
The parameter RAM is preferably, but necessarily, located (as seen by the microprocessor) at an address range which is overlaid onto the addresses which otherwise would be accessed by the microprocessor for data operations from external memory.
It is also highly preferable, but not strictly necessary, that the parameter RAM be physically located on the adjunct chip.
Ser. No. 567,466: Peripheral which can Revector a Microprocessor's Instruction Sequencing into Secure Memory and which Contains Hardware for Running Checks on Program RAM
Among the innovations disclosed herein is an adjunct chip, usable as a peripheral to a microprocessor, which provides greatly increased assurance of software integrity. The adjunct chip contains on-chip ROM memory, which holds secure control programs, and on-chip hardware for implementing CRC logic. The adjunct chip intercepts address lines from the microprocessor, and can selectably overlay its on-chip ROM onto the microprocessor's address space. The adjunct chip can issue resets, to force the microprocessor to come up running the secure control software.
The secure control software includes commands for running CRC checks on the microprocessor's program RAM. To accelerate the calculation of redundancy-check-values, and assure their sanity, the adjunct chip contains hardware for calculating the redundancy-check-values.
This is particularly useful in systems using battery-backed memory, since users may want the additional reassurance of software integrity checking. This is also expected to be useful in certain control applications where reliability is essential. This may also be useful in installations which are subject to high electrical noise, relatively high levels of ionizing radiation, and/or sporadic high temperatures. Examples include avionics, factory floor automation, and vehicular control.
Ser. No. 567,365: Processor-Processor: Interrupt Masking with Logical Sum and Product Options
Among the innovations disclosed herein is a new circuit organization for interfacing asynchronous processors to each other.
A great deal of work has been devoted to the problem of how two processors can talk to each other. In conventional processor architectures, each individual processor can only attend to one task at any one moment. Thus, for processor A to respond to communications from processor B, processor A's own task may have to be interrupted.
Thus, a basic dilemma in processor-processor interfaces, in most architectures, is:
urgent messages have to get through; PA0 but messages have to be screened, so that not all necessarily get through. PA0 1) nonvolatility PA0 2) and additional ports PA0 3) and broader electrical port compatibility PA0 4) and more versatile interrupt-handling, PA0 5) without losing any of the microprocessor's capabilities; PA0 6) and provides all of the foregoing advantages in a package which is readily adaptable to other microprocessors. PA0 Reloading the target microprocessor's program memory; PA0 Performing CRC check operations on the target microprocessor's program memory. PA0 (1) Some programmable bits are writable only while the microprocessor is executing code from the adjunct chip ROM. PA0 (2) Some programmable bits are protected by timed-access relations, so that the bit can be accessed only within a certain time window defined with respect to a particular sequence of writes to a register. (See U.S. patent application Ser. No. 163,980, Filed Mar. 4, 1988, which is hereby incorporated by reference.) PA0 (3) Some bits are protected both by limitation to control software and by timed-access relationships.
Many multiprocessor systems use an interrupt architecture which is predefined, at a high level, to provide (it is hoped) the desired degree of flexibility. For example, EPC patent 0,071,727, which is hereby incorporated by reference, shows a multiprocessor system in which every interrupt carries with it one of 256 priority levels.
However, the disclosed innovation provides a significant advance over this, in that hardware-programmable interrupt masking logic permits the receiving processor to select what interrupt condition, or combination of conditions, it will or will not respond to.
In particular, the disclosed innovation provides interrupt masking logic which the receiving processor can program to select not only which one or more interrupt conditions will be considered, but also what logic combination of these conditions will be responded to.
A further feature of this interface is that it is programmable from both sides of the interface.
Ser. No. 567,394: Peripheral which Wraps a More Flexible Processor Interface Around an Existing Microprocessor
Among the innovations disclosed herein is an adjunct chip (usable as a peripheral to a microprocessor) including two-way interrupt-handling logic which provides more flexible interface between the microprocessor and a host processor or external processor or peripheral controller. The circuitry of this interrupt-handling logic is itself believed to be novel.
Ser. No. 567,437: Latched Multiplexer for Stabilizing the Switch from Crystal to Ring Oscillator at Power-Down
Priority is hereby claimed from co-pending U.S. application Ser. No. 238,809, Filed Aug. 31, 1988, entitled "Nonvolatile Microprocessor with Predetermined State on Power-down."
Among the innovations disclosed herein is an adjunct chip, usable as a peripheral to a microprocessor, which detects power failure, and puts the microprocessor into a known state upon power down, and then resets the microprocessor.
In order to reliably and stably put the microprocessor into a known state, several clocks are generated before the reset signal. However, since the power supply is failing, it is possible that the crystal-controlled oscillator may already have become unreliable. Therefore, a simple logic circuit (a ring oscillator, in the presently preferred embodiment) is used to generate the needed additional clocks at power-down..sup.6 FNT .sup.6 This was the teaching of commonly owned application Ser. No. 238,809, Filed Aug. 31, 1988 ("Nonvolatile microprocessor with predetermined state on power-down,"), which is hereby incorporated by reference. The preferred embodiment, in that application, was a nonvolatized microprocessor which included a ring oscillator on-chip to generate these additional clocks upon power-down reset.
However, the present application further teaches that the switch from crystal-controlled oscillator to ring oscillator needs to be stabilized. The ring oscillator consumes much less power than the crystal oscillator, and the microprocessor in sleep mode will consume still less. Thus, where the system power supply has a relatively high source impedance and a relatively light load, the power supply voltage may increase again after the power supply is unloaded by turning off the crystal oscillator. Under a worst-case scenario, the oscillator may be turned on and off several times. This is undesirable, because it may generate clock "slivers," i.e. short transients which may cause anomalous logic state propagation.
In the presently preferred embodiment, the switch from crystal-controlled oscillator to ring oscillator is stabilized by using a latched multiplexer to switch between the two oscillator inputs. The latch adds hysteresis to the switching characteristic, avoiding any problem of switching jitter.
Ser. No. 567,359: Filtered Detection plus Propagated Timing Window for Stabilizing the Switch from Crystal to Ring Oscillator at Power-Down
Priority is hereby claimed from co-pending U.S. application Ser. No. 238,809, Filed Aug. 31, 1988, entitled "Nonvolatile Microprocessor with Predetermined State on Power-down."
Among the innovations disclosed herein is an adjunct chip, usable as a peripheral to a microprocessor, which detects power failure, and puts the microprocessor into a known state upon power down, and then resets the microprocessor.
In order to reliably and stably put the microprocessor into a known state, several clocks are generated before the reset signal. However, since the power supply is failing, it is possible that the crystal-controlled oscillator may already have become unreliable. Therefore, a simple logic circuit (a ring oscillator, in the presently preferred embodiment) is used to generate the needed additional clocks at power-down..sup.7 FNT .sup.7 This was the teaching of commonly owned application Ser. No. 238,809, Filed Aug. 31, 1988 ("Nonvolatile microprocessor with predetermined state on power-down,"), which is hereby incorporated by reference. The preferred embodiment, in that application, was a nonvolatized microprocessor which included a ring oscillator on-chip to generate these additional clocks upon power-down reset.
However, the present application further teaches that the switch from crystal-controlled oscillator to ring oscillator needs to be stabilized. The ring oscillator consumes much less power than the crystal oscillator, and the microprocessor in sleep mode will consume still less. Thus, where the system power supply has a relatively high source impedance and a relatively light load, the power supply voltage may increase again after the power supply is unloaded by turning off the crystal oscillator. Under a worst-case scenario, the oscillator may be turned on and off several times. This is undesirable, because it may generate clock "slivers," i.e. short transients which may cause anomalous logic state propagation.
In the presently preferred embodiment, the switch from crystal-controlled oscillator to ring oscillator is stabilized by using a nonlinear filtered circuit (driven by both the ring oscillator and the crystal oscillator) to detect when the crystal oscillator actually begins to fail. A transmission gate is then disabled, and the state frozen for long enough to allow any changes to propagate through.
Ser. No. 567,356: Peripheral for Transparently Revectoring a Processor's Sequencing into Peripheral's On-chip ROM
Among the innovations disclosed herein is an adjunct chip, usable as a peripheral to a microprocessor, which intercepts instruction fetches to RAM from the microprocessor, and can (selectably) substitute a block of instructions in the peripheral's on-chip ROM for the software stored in RAM. This can be used for verification or other control programs, to provide improved reliability.
Ser. No. 567,357: System with Microprocessor, Modem, and Monitor Chip which can Call for Help if Software Integrity is Lost
Priority is hereby claimed from commonly owned co-pending U.S. application Ser. No. 282,702, Filed Dec. 9, 1988.
Among the innovations disclosed herein is a system which includes a microprocessor and a modem, and also includes an adjunct chip which can force the microprocessor through integrity checks and which can call for help if software integrity is lost.
Ser. No. 567,468: Peripheral Monitor Chip Which Can Call for Help and/or Force Program Branching
Priority is hereby claimed from commonly owned co-pending U.S. application Ser. No. 282,702, Filed Dec. 9, 1988.
Among the innovations disclosed herein is an adjunct chip, usable as a peripheral to a microprocessor, which monitors the microprocessor's activity, and can force the microprocessor to reset, and can force the microprocessor to run a verification program (or other control program), and can call for help if software integrity is lost.
Ser. No. 567,360: Peripheral with On-chip Flag Bit which Enables Running Control Software from Secure Memory
Among the innovations disclosed herein is an adjunct chip, usable as a peripheral to a microprocessor, which provides control software in secure memory, at an address range which is overlaid onto the addresses which otherwise would be accessed by the microprocessor to run programs from external memory. A flag bit, in the peripheral's on-chip memory, generally selects whether execution of the control software will occur on power-up or other reset. This permits easy entry into the control software, while still providing great protection for the integrity of the control software and its registers.
Ser. No. 567,435: Integrated Circuit Which Turns Off Hysteresis in Sleep Mode
Among the innovations disclosed herein is an integrated circuit which turns off a switchable timed hysteresis circuit upon entering sleep mode.
The presently preferred embodiment includes an adjunct integrated circuit, usable as a microprocessor peripheral, which contains circuitry to detect when the power supply goes out of tolerance, and which generates interrupt, reset, and clock.sup.8 signals for the microprocessor. FNT .sup.8 The clock signals are generated by a ring oscillator circuit if the crystal-controlled oscillator stops.
Timed hysteresis is used to implement the power-down reset and interrupt relationships. This is advantageous because it avoids a problem of repeatedly activating reset or interrupt signals on power-down or even on a slow power-up due to clock "slivers," i.e., noise seen inside the chip from clock transitions.
Other integrated circuits, such as the DS1236, have used timed hysteresis for stabilizing a transition.
However, the integrated circuit disclosed herein has the further capability of entering a sleep mode. This poses a difficulty in that, in sleep mode, there are no clocks available in the adjunct chip. Therefore, in sleep mode, the hysteresis circuit is simply bypassed. This provides the advantages of a stabilized transition, and also provides the advantages of sleep mode. Moreover, these advantages combine synergistically in the various system and subsystem embodiments described below.
Ser. No. 567,397: Frequency-Independent Monitor Circuit
Among the innovations disclosed herein is a clock monitor circuit which is frequency-independent. The clock terminals on a circuit being monitored for activity may be considered as an inverter combined with a phase delay. The innovative circuit has clock-output and clock-input terminals.sup.9 which are connected to the clock terminals on the circuit being monitored. When a rising edge appears on the clock-output terminal, the clock-input line is sampled: if the circuit being monitored is properly active, the level on the clock-input line will be high. Similarly, when a falling edge appears on the clock-output terminal, the clock-input line is sampled: if the circuit being monitored is properly active, the level on the clock-input line will be low. Whenever a low level is detected on a rising edge, or a high level on a falling edge, a counter chain will start counting down. The counter chain will be reset only when a high level is detected on a rising edge AND a low level is detected on the next falling edge. FNT .sup.9 The innovative circuit preferably also has two additional terminals which are connected to a crystal.
Thus, when the circuit being monitored becomes inactive, the counter chain will start to count down, and will eventually reach zero. In the presently preferred embodiment, this condition is used to detect that the microprocessor has gone to sleep, and accordingly the crystal oscillator can be stopped.
Ser. No. 567,467: Mirror-Image SipStik Subboard
Another innovative feature set forth herein is an innovative microboard package.
SipStik.TM. packages, having a similar form factor to a SIMM memory module, have been introduced by Dallas Semiconductor to package complex logic, analog, and/or telecommunications functions. In the presently preferred embodiment, a subsystem such as shown in FIGS. 1A-1, 1A-2, or 2A-1, 2A-2 is packaged in a new kind of SipStik.
SipStiks have a substantial advantage in their very low height and compact size, but sometimes it is difficult to find room for the desired pinout along one edge of such a small package.
In the presently preferred embodiment, a SipStik package is used which has SipStik connectors along both the upper and lower edges, as shown in FIG. 16. This innovative structure can be used in multiple ways.
In the presently preferred embodiment, an integrated subsystem as shown in FIGS. 1A-1, 1A-2, or 2A-1, 2A-2 can be used as a microprocessor or as a microcomputer. However, the pinouts desired for these two uses are not identical, and the total available pinout, with the preferred pin spacing and package dimensions, does not permit all of the signals desired for either use to be brought out. Therefore, the presently preferred embodiment provides a "mirror-image" SipStik, which can be inserted in one orientation to provide a microprocessor functionality, and can be inserted upside-down to provide microcomputer functionality.
Another way of using this mirror-image SipStik is to connect a jumper connector to the top connection row. Since the top connection has the same form factor as the main connection, an adaptation of the same connector can be used to connect the Stik's top connector to a flat ribbon cable.
A further variation of this is that the same connector header, which is normally mounted on a PC board to receive a SipStik module, is modified, with a small complementary header, to mate to the connector on the top edge of a SipStik board. This provides system designers with tremendous flexibility.
The SipStik modules normally have a battery mounted on-board, and are normally encapsulated by a conformal sealant to reduce exposure of the battery to environmental conditions. This environmental sealant, of course, does not extend over the connector areas. The mirror-image SipStik disclosed herein is therefore entirely compatible with this sealing process.
Of course, a wide variety of modifications of this idea can be used if desired.
Innovative System Architecture with Nonvolatizing Adjunct Chip
The present application describes a nonvolatizing adjunct chip (a "softener" chip) which can be used in combination with a variety of microprocessors or microcontrollers to add nonvolatile functions into these machines. Thus, existing logic chips can be made crash-proof. In addition, the adjunct chips provide a power monitoring function, which will generate interrupts and/or resets when the system power begins to fail, permitting orderly shutdown.
The adjunct chip is a complex logic chip, but it is not (in the presently preferred embodiments) a fully programmable processor. The associated processor provides programmable instruction execution; the adjunct chip merely provides an add-on component, which adds nonvolatility.
The adjunct chip of the presently preferred embodiment performs a number of valuable functions: it not only nonvolatizes the microprocessor, but also "wraps around" the microprocessor to provide additional ports (and expanded electrical interface options), and also additional options for a hardware/software interface to another system.
Thus, the adjunct chip of the presently preferred embodiment "wraps around" a microprocessor to provide
ROM-Based Control Software as a Touchstone for Verification
An important motivation for the use of ROM, in a nonvolatized system, is that ROM provides a firm foundation for verification of software integrity.
Innovative Adjunct Chip Architecture
Some of the noteworthy novel features of the adjunct chip's architecture (in the presently preferred embodiment), which lead to substantial system-level advantages, will now be described.
Control Software versus User Software
The adjunct chip provides a program memory revectoring capability, so that the code executed by the microprocessor can be sequenced from the adjunct chip's ROM or from external RAM. Operation of the microprocessor from these sources of code is handled very differently. This novel architecture includes several features of interest.
First, execution of ROM software provides a highly secure basis for program verification. To facilitate this, the ROM software, and its on-chip RAM data, are heavily protected against incursions by user software. Reliable routes for entering and leaving ROM software are provided, which retain security without greatly impeding operation.
Second, it should be noted that, when the microprocessor is operating from the adjunct chip's ROM software, the adjunct chip is not actually sequencing code to the target microprocessor. (This would present some architectural incompatibility.) Instead, the adjunct chip provides overlaid interception capabilities which provide essentially the same functionality. Thus, while the function of the adjunct chip is probably more analogous to a sequencer than to a full coprocessor, it is in fact neither a sequencer nor a coprocessor.
Third, some significant tricks are used in handling the address map, as will be discussed in detail below. The control-software code is overlaid onto the RAM address space, and several features are used to facilitate this overlay.
Operating from RAM or External ROM
A bank of external memory is used, conventionally, to store programming and data for the target microprocessor. During normal operation of the microprocessor (with system power on), the adjunct chip permits sequencing of code from the external program RAM, so that the adjunct chip is transparent to the microprocessor.
However, to assist in the adjunct chip's nonvolatizing functions (at startup), and to assist in assuring code integrity, the adjunct chip also includes a block of program ROM. This is used to perform control functions as described below.
Some innovative ideas are also used for transition between sequencing code from ROM and sequencing code from program RAM, as described below.
Functions Governed by Control Software
When the microprocessor is operating in control mode, the softener redirects addresses as follows: when the microprocessor tries to access an initial address in program RAM, the adjunct chip revectors this access so that the microprocessor is reading out (and executing) the start-up code which is stored in the adjunct chip's ROM.
In the presently preferred embodiment, the code contained in ROM is used for two major functions:
The adjunct chip also includes 16 bytes of internal RAM which are only accessible by the control software, not by the user software. In the presently preferred embodiment, this RAM is further protected by timed-access relationships. These bytes are used to store the high and low boundaries for CRC operation.
Entering Control-Software Execution
The adjunct chip provides both software and hardware avenues to enter execution of the control software. This unusual degree of flexibility has been achieved without compromosing the security and stability of the system.
The control software can be exited by clearing the "ROM" bit in the adjunct chip's RAM. This automatically causes a reset to be issued, following which the microprocessor will be allowed to run in application mode.
As background, it should be noted that the DS5000 nonvolatile microcontroller performs an automatic reset on exiting ROM code. See commonly owned U.S. patent application Ser. No. 164,097, Filed Mar. 4, 1988, and entitled "Partitionable embedded program and data memory for a central processing unit," which is hereby incorporated by reference.
Control-Software Routines: CRC
At every entry into the control software, a branch to control or reloading routines is made.
In the presently preferred embodiment, the ROM memory in the adjunct chip can be accessed when the microprocessor powers up, and a CRC check then run on the user program, in external RAM.
In the presently preferred embodiment, the adjunct chip itself contains hardware for generating the Cyclic Redundancy Check (CRC) check value. The microprocessor merely has to read out the data values in the range to be checked, and push them successively into a register address. The softener hardware captures writes to this address, and loads the stream of values into its CRC hardware. The microprocessor can fetch the computed CRC value by simply reading another "register," at a register address which is remapped into the softener. Thus, the microprocessor never has to do the many shift and XOR operations for CRC computation: it simply performs a series of 8-bit register writes, a 16-bit register read, and a compare operation. This speeds up CRC generation, and allows system software designers to use CRC checking more readily.
The arguments for CRC check operations, including high- and low-address boundaries and the expected check value, are kept in the adjunct chip's on-chip RAM. (This RAM is only accessible when the microprocessor is executing code from ROM.) Thus, when a CRC operation is initiated, the designated block of memory will be processed to generate a CRC redundancy check value.
Control-Software Routines: Reloading
An important control operation, performed under the control of adjunct chip ROM code, is reloading the RAM code which will be executed by the target microprocessor. This prevents any possibility of the target microprocessor reaching a "stuck" condition due to corruption of the RAM code.
One of the ways to initiate such a program reload is by means of the RL* input signal. (There are other ways, as described below.) The RL* input, which is used to control reloads, is not purely a logic level. The following table gives a concise summary of some of the key relationships: ##SPC1##
A reload command causes a reset, which then branches into the adjunct chip's ROM address space. When execution of the control software is completed, the adjunct chip will again reset the target microprocessor, and execution can then begin in the user's program memory.
Exiting Control Software Execution
At the end of a control-software program, the microprocessor is commanded to clear the ROM-software-enable bit. This automatically causes the microprocessor to be reset; when the microprocessor comes back up after the reset, it is allowed to execute code from RAM. Execution of application software can then proceed normally.
Flexible Port Architecture
One of the architectural points to be considered in the adjunct chip architecture is the use of ports.
Note that the adjunct chip of the presently preferred embodiment consumes at least one port of the microprocessor, and ports are a valuable resource in microprocessor system configurations. Therefore, the adjunct chip of the presently preferred embodiment provides additional port capacity, which can be used to provide close-in port multiplexing of the microprocessor, or simply to avoid any net loss of port capacity.
Moreover, the adjunct chip of the presently preferred embodiment also includes considerable additional port-interfacing logic, to increase the designer's options for interfacing the microprocessor to another system.
Option for Address/Data Multiplexing
Some microprocessors multiplex address and data onto the same set of pins, using a control signal such as ALE or AS. To accommodate this, the adjunct chip provides a process mask option so that multiplexing can be selected or deselected.
Super-Adaptable Port ("Cadillac" Port)
One of the features of the preferred adjunct chip architecture is that one of the ports is made extremely versatile and programmable. To ensure that port versatility is not lost, the preferred embodiment of the adjunct chip contains one port (Port A) which has extraordinarily high versatility. This port is programmable bit-by-bit to emulate a very wide variety of port characteristics.
This port can implement either full Motorola or full Intel.sup.10 port relationships. In addition, this port has the capability to read either the pad or the data register, independently of the data direction. Thus, the innovative port provides the capability for full Motorola emulation, and also provides additional flexibility. FNT .sup.10 The Motorola and Intel electrical definitions are significantly different, as described below.
This port also has the ability to sense an edge transition, of either sign, or to sense a level of either sign (as long as it remains for more than one bus cycle) and to generate interrupts therefrom, in accordance with mask bits.
The ability to sense edges is particularly useful, since one problem with microprocessor ports in general is that some input signals may generate an edge at the microprocessor port which does not correspond to a long-term level shift. The sampling time of the microprocessor may be long enough that such a pulse could be missed.
System Interface and Register File Structure
The presently preferred embodiment includes a highly flexible register file structure, which contains several innovative features to faciliate control interactions between the adjunct chip and the target microprocessor. (Some of these innovations are also applicable to handshaking, semaphoring, and other control interactions across any asynchronous processor-processor boundary.)
Background: the Intel 8042 Interface
The 8042 (which was a remake of the 8048) converted two ports of the architecture to provide a register which was directly interfaced to the PC bus. This presented some difficulty at the time, since the PC bus was faster than the typically slow microcontroller. The 8042 therefore used a two-port asynchronous latch. The 8042 is still very commonly used to provide the keyboard interface in IBM PC/AT-compatible architectures.
The asynchronous latch of the 8042 provided one 8-bit input register and one 8-bit output register. A status register, with an appropriate flag bit, is used to differentiate between command and data loads.
Overall Architecture of the Innovative Interface
The register file structure adds capability to a microprocessor. In effect, this structure also expands the capabilities of the microprocessor, by adding more flexible interrupt handling, and thus better communications with other, asynchronous, processors.
Status Registers
The status registers are double buffered. The adjunct chip includes eight input registers, eight output registers, and eight registers for command, control, and status information. These 24 registers actually only have 16 register addresses. (The implementation of this will be described below.)
The status registers also include four flags which can be used to set interrupt dependencies. The status registers also include mask bits which can be used to mask the interrupts generated from the opposite status register. Thus, the internal side of this interface can set a bit to mask interrupts which would otherwise be generated by status information input from the external side of the status register.
Input and Output Registers
The eight input buffer registers (labeled "IB") are writable externally and readable internally. The eight output buffer registers (labeled "OB") are readable externally and writable internally.
While the average speeds on the two sides of the interface are typically comparable, they are necessarily asynchronous. Thus, the described architecture provides particular advantages in this asynchronous interface. The innovative ideas used in this interface architecture can also be used in other asynchronous interfaces, particularly where control information must be passed across an asynchronous boundary.
The IBF and OBF registers provide write/read flags for the corresponding registers. Thus, these flags will indicate to the reading side whether new information has been written in from the other side, and will indicate to the writing side whether the reading side has yet read out the previously written information. (The IBF and OBF registers are operated as slaves.)
The mask registers (internal IBM, internal OBM, external IBM, external OBM) indicate which of the input and output registers can generate an interrupt. The bits in the status registers can also indicate an "and" relationship or an "or" relationship. Note that the internal IBM and OBM registers are controlled from the internal side, and the external IBM and OBM registers are controlled from the external side. Thus, there is full programmability in controlling the automatic generation of interrupt signals based on the status of buffer registers. This is believed to be a new and generally applicable way to control status information.
Special Hardware for CRC Generation
The adjunct chip also includes hardware cyclic redundancy check circuits. In the presently preferred embodiment, these follow the US CRC-16 standard, but the European standard is available as a mask option.
Freshness Seal Circuitry
The adjunct chip, in the presently preferred embodiment, also includes a freshness seal circuit, so that absolutely no battery drain will occur before the chip is placed in service.
Accommodation of Processor's "Sleep" Mode
Some processors have a "stop" mode (also known as a sleep mode). In general, this capability is used to provide a low-power idle state for the microprocessor.
The adjunct chip also has a low-power sleep mode, which it can enter when the target microprocessor is asleep. It would be wasteful for the adjunct chip to remain in an active high-power mode if the microprocessor has gone into a low-power sleep mode. Thus, the following discussion relates not only to issues of shutting down and waking up the microprocessor, but also to issues of shutting down and waking up the adjunct chip.
When the adjunct chip enters sleep mode, it will typically interrupt the oscillator clock to the microprocessor; interrupt reset signals to the microprocessor; and turn off its watchdog circuit. Also, on entering sleep mode, the op amp's current source is turned down. This causes the op amp to react more slowly.
In an optional alternative (not included in the presently preferred embodiment), the adjunct chip can see a "stop" instruction come through in the microprocessor's code being executed from RAM, and can thereby anticipate a "sleep" command from the microprocessor.
For a further example, the adjunct chip can monitor electrical activity on the microprocessor's output lines. If a certain number of clocks pass with no activity whatsoever on the microprocessor's clock-output line, the adjunct chip can assume that the microprocessor has gone to sleep.
In the system architecture, the microprocessor is not directly connected to a crystal. Instead, the adjunct chip is interposed between the microprocessor and its crystal. Similarly, the adjunct chip is interposed between the microprocessor's reset input and the external reset connection.
Thus, when the adjunct chip determines that the microprocessor is in sleep mode, the adjunct chip can turn off clock pulses to the microprocessor. Similarly, when the microprocessor is to wake up again, the adjunct chip can restart the oscillator, and wait for the oscillator to stabilize, before allowing the microprocessor to be clocked by the oscillator. (In the presently preferred embodiment, the microprocessor is held in reset while the oscillator stabilizes.) The oscillator will normally have a significant current burn, and it is desirable to avoid this when the system is in a minimum-power mode.
Some microprocessor architectures require that the microprocessor be awakened from sleep mode if an interrupt is received. Accordingly, the adjunct chip also has a mask option whereby the microprocessor will be awakened if an interrupt is received.
Other conditions wherein the target microprocessor will be reawakened include detection of a power-down condition (as described below) or a reload operation.
Generation of Reset or Interrupt Signals on Power-Down
When the adjunct chip detects that power supply voltage is below limits, it will send the microprocessor an interrupt, and then (after some intervening clock cycles) a reset, and then will send more clock pulses before going into a "stop" mode. (The adjunct chip's stop mode, like the microprocessor's sleep mode, provides reduced power consumption during long periods of inactivity.)
In the presently preferred embodiment, timed hysteresis is used to implement the power-down reset and interrupt relationships. This is advantageous because it avoids a problem of repeatedly activating reset or interrupt signals on power-down or even on a slow power-up due to clock "slivers," i.e., noise seen inside the chip from clock transitions.
However, a difficulty is that, in sleep mode, there are no clocks available in the adjunct chip. Therefore, in sleep mode, this hysteresis circuit is simply bypassed.
Other integrated circuits, such as the DS1236, have used timed hysteresis for stabilizing a transition. However, an integrated circuit which turns off a switchable timed hysteresis circuit upon entering sleep mode is advantageous, and is believed to be novel.
Awakening
Some microprocessors are designed to wake on an interrupt. The adjunct chip family has a mask option so that the target microprocessor can be waked when the appropriate interrupt is received.
Different versions of the adjunct chip will also wake the microprocessor upon a power-down or from a program reload.
Reference Voltage Generation
The adjunct chip also includes a band-gap voltage reference. This function is somewhat power hungry. Therefore, in sleep mode, the band-gap voltage reference is switched off. Instead, in sleep mode, the battery input is used as the reference input to comparators. When the chip returns to the active mode, the band-gap voltage reference is reactivated, and this output is used for a reference input.
Watchdog Function
The adjunct chip also contains a watchdog function. This function, too, is made programmable. Thus, the user can determine what period of inactivity the watchdog function should wait for before activating a reset or interrupt. Moreover, the watchdog can optionally be turned off. (The watchdog function is also turned off when the adjunct chip enters its stop mode.)
The watchdog function is always active when the microprocessor is being operated from adjunct chip ROM.
Protection of Programmable Options
As noted, the softener chip also includes a small amount of parameter RAM, which is used to preserve the status of various programmable options. In the presently preferred embodiment, this RAM includes only 16 bytes, which are organized in two blocks: Each holds a start address, an end address, and a CRC value.
The watchdog parameters, like other programmable options, need to be insulated against accidental corruption by application software. Several techniques are used to provide such protection:
Different Versions for Different Processor Families
In the presently preferred embodiment, the adjunct chip can exist in several different versions, which each have slightly different features (implemented by a simple mask option, as described below), depending on which target microprocessor is to be used. In the present class of embodiments, five different versions of the adjunct chip are contemplated, aimed at five different families of target microprocessor. Of course, further versions of the adjunct chip can also be added, with other target microprocessors.
A further advantage of the adjunct chip is that it can provide great versatility in the device-level architecture of the target microprocessor. Thus, the CMOS adjunct chip can be combined with an NMOS, or even bipolar, target microprocessor to provide a low-power and crash-proof system.
Nonvolatizing Associated Memory
Another general feature which is provided by the adjunct chip is a nonvolatizing interface for control of SRAMs. The ability to preserve data in a bank of memory provides a tremendous increase in system versatility.
Memory-Map with Sliding Overlay
The softener ROM and the softener RAM are both overlaid onto program memory. Moreover, this is a sliding overlay, so that none of the underlying memory space is lost.
Address Inversion for Program Loading
Program reloading, while the microprocessor is executing a different program from memory which is overlaid onto the program memory's space, presents a potential address conflict. In the presently preferred embodiment, an address inversion scheme avoids any such conflict.
Due to address overlap between the ROM-code space and the application program address space, an address remapping trick is used for initial loading of program memory. One or more high-order address bits are inverted to permit writing into the address space under the ROM-code addresses, without redirecting the sequence of ROM-code execution. A special chip-enable decoder is used to correct the inverted address bits.
Sliding Window of Memory Protection
A variety of problems arise in attempting to accommodate the wide variety of architectures, port interfaces, and other requirements of various microprocessors.
For example, the 8051 architecture carries data and program memory in two separate memory maps. In this architecture, it is impossible for the application program to write in program memory--there is simply no instruction to do this. However, Motorola architecture (e.g., in the 6800 and related chips) has a common memory architecture, where data and program memory share the same address space. This can be a danger in RAM-based systems, since it is conceivable that the user memory may overwrite some of the program and thus cause unpredictable results.
The adjunct chip, in the presently preferred embodiment, includes a sliding window of memory protection to prevent the user program from overwriting the operating program inadvertently. The adjunct chip intercepts the write-enable signals to the memory, and controls generation of the chip-enable signals, to implement this protection. This solves an important problem with nonvolatizing Motorola architectures.
Multiple Chip-Enable Outputs for Other Attached Chips
A further feature of the adjunct chip is to provide multiple chip-enable outputs for other peripheral chips. Preferably one output is provided for battery-backed chips, and one for chips which are not battery-backed (e.g., for a non-battery-backed clock, such as DS1283, or a UART). The chip-enable lines to battery-backed chips are preferably held high (inactive) while power is down, to keep those chips from being turned on by random floating-node voltages.
Getting the Processor into a Known State upon Reset
The DS5000 microcontroller switches from a crystal-controlled oscillator to a ring oscillator on power-down, since the crystal oscillator will cease to operate, at some point, as the voltage drops..sup.11 FNT .sup.11 In the DS5000, the ring-oscillator clocking is used to ensure generation of sufficient clock cycles, after the power-down reset, to end up in a known state. See commonly owned application Ser. No. 238,809, Filed Aug. 31, 1988 ("Nonvolatile microprocessor with predetermined state on power-down,"), which is hereby incorporated by reference.
The adjunct chip, in the presently preferred embodiment, also includes a ring oscillator which is used for reliable clock generation when the power supply goes below the acceptable threshold.
However, a potential problem exists in such use of a ring oscillator: An active microprocessor will burn a fairly large current, e.g. 25 milliamps. When the microprocessor stops (in a lightly loaded system), the power supply voltage V.sub.DD may bounce..sup.12 This voltage bounce may cause the microprocessor to resume operation: In a worst-case scenario, this may happen repeatedly. FNT .sup.12 The amount of voltage increase, or bounce, will depend on the power supply's source impedance. Source impedance is typically lower for higher-capacity power supplies. Source impedance also may be current-dependent.
This problem has been solved in two innovative ways:
First Solution: Use a MUX to select between the crystal oscillator and the on-chip ring oscillator, and include a latch in the MUX. This latch imposes hysteresis, which avoids the bouncing.
Second Solution: Use a counter (connected with the ring oscillator at the clock input and the crystal oscillator at the reset input) to filter the crystal oscillator's signal to provide a reliable indication of crystal oscillator failure; and: Use a timing window guardband, and a transmission gate plus latch to freeze the input, where the timing window guardband is a long enough delay to allow the frozen input condition (whatever it is) to propagate through the system.
Innovative Microboard Structure
Another innovative feature set forth herein is an innovative microboard package.
SipStik.TM. packages, having a similar form factor to a SIMM memory module, have been introduced by Dallas Semiconductor to package complex logic, analog, and/or telecommunications functions. In the presently preferred embodiment, a subsystem such as shown in FIGS. 1A-1, 1A-2, or 2A-1, 2A-2 is packaged in a new kind of SipStik.
SipStiks have a substantial advantage in their very low height and compact size, but sometimes it is difficult to find room for the desired pinout along one edge of such a small package.
In the presently preferred embodiment, a SipStik package is used which has SipStik connectors along both the upper and lower edges, as shown in FIG. 16. This innovative structure can be used in many ways.
In the presently preferred embodiment, an integrated subsystem as shown in FIGS. 1A-1, 1A-2, or 2A-1, 2A-2 can be used as a microprocessor or as a microcomputer. However, the pinouts desired for these two uses are not identical, and the total available pinout, with the preferred pin spacing and package dimensions, does not permit all of the signals desired for either use to be brought out. Therefore, the presently preferred embodiment provides a "mirror-image" SipStik, which can be inserted in one orientation to provide a microprocessor functionality, and can be inserted upside-down to provide microcomputer functionality.
Nonvolatized Microprocessor Module in Combination with Other Modules
A particularly advantageous system embodiment is a combination of a nonvolatized microprocessor module (such as the DS2340 described below) in combination with other modules which permit dial-up telephone access. For example, this is permitted by a DS2245 Modem Stik in combination with a DS2249 DAA Stik.)
In the presently preferred embodiment, the 16 bytes of RAM on the adjunct chip are used not only to store CRC parameters, but also are used to store a modem-present flag and a "help-me" flag. The modem-present flag is programmed at the time of system configuration to indicate to the adjunct chip's control software that, when an error condition occurs, the dial-up capability can be used as part of the error handling routine.
When the CRC logic detects an error, as shown in the flow chart of FIG. 15, it can seek help from a remote host system. The remote host can then program in successively narrower CRC boundary values, to zero in on a bad block of code. When a sufficiently small bad block of code has been identified, this code can be reloaded over the modem link without consuming a large amount of modem time. Moreover, all of this can be performed automatically, without requiring human assistance.
Power-Fail Output Signals
In the presently preferred embodiment, the softener chip now has two power-fail output signals, called V3 and V45. These signals can be propagated around a system to avoid skew in the power-down transitions on different chips.
This is useful even if other chips also have a bandgap reference on-chip: In a complex system, you do not want to have more than one bandgap operating independently: The softener would probably be the master power-fail detector and let the other nonvolatized subsystems use a power-fail input.